diff --git a/contrib/caddy/Caddyfile b/contrib/caddy/Caddyfile
index 9c013d1..f262cae 100644
--- a/contrib/caddy/Caddyfile
+++ b/contrib/caddy/Caddyfile
@@ -14,6 +14,11 @@ private.coffee www.private.coffee {
 		path assets /assets/*
 	}
 
+	@security {
+		path security-well-known /.well-known/security.txt
+		path security /security.txt
+	}
+
 	handle @matrix {
 		header /.well-known/matrix/* Content-Type application/json
 		header /.well-known/matrix/* Access-Control-Allow-Origin *
@@ -26,6 +31,10 @@ private.coffee www.private.coffee {
 		root * /srv/private.coffee
 	}
 
+	handle @security {
+		redir https://security.private.coffee/security.txt
+	}
+
 	handle {
 		reverse_proxy * unix//var/run/uwsgi/privatecoffee.sock
 	}